Path: ...!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Frank Slootweg <this@ddress.is.invalid>
Newsgroups: comp.mobile.android
Subject: Re: Codes sent by text message
Date: 12 Mar 2024 13:29:10 GMT
Organization: NOYB
Lines: 40
Message-ID: <uspor9.neo.1@ID-201911.user.individual.net>
References: <ush35k$2791b$1@dont-email.me> <usid1f$2fqif$1@dont-email.me> <usn5ia$3lqer$1@dont-email.me> <1mtd3l3os6odg.dlg@v.nguard.lh> <usnm5e.7g4.1@ID-201911.user.individual.net> <usp2um$6ate$1@dont-email.me> <usp9g2.f1k.1@ID-201911.user.individual.net> <usp8e3$7g77$1@dont-email.me>
X-Trace: individual.net pHLyogUmxE9wpcjC/sIu9AwD5e9QzovhLNIJzyB8l/p0UzhhRM
X-Orig-Path: not-for-mail
Cancel-Lock: sha1:NAEL9vMlJdiuEQwnP+UrJr+7T98= sha256:FH7nwQOx2TqYYP154JWOfWsxF/AboISzHXq05YHKEgI=
User-Agent: tin/1.6.2-20030910 ("Pabbay") (UNIX) (CYGWIN_NT-10.0-WOW/2.8.0(0.309/5/3) (i686)) Hamster/2.0.2.2
Bytes: 2916

Dave Royal <dave@dave123royal.com> wrote:
> Frank Slootweg <this@ddress.is.invalid> Wrote in message:
> 
> > Chris <ithinkiam@gmail.com> wrote:
> >> Frank Slootweg <this@ddress.is.invalid> wrote:
> >> > VanguardLH <V@nguard.lh> wrote:
> > [...]
> >> >   As Dave Royal also mentioned, your bank probably mentions/'supports'
> >> > one or more TOTP 'apps'/programs, but - assuming they have not
> >> > re-invented the wheel - their systems should be standards-compliant and
> >> > hence worke with any standards-compliant 'app'/program.
> >> 
> >> Sadly in the UK that's not the case. They either use SMS, an automated call
> >> or their own TOTP available in their app. 
> > 
> >   It's similar in The Netherlands, at least for my banks and other banks
> > I know of. But SMS and automated call are (AFAIK) not used. Just a
> > bank-specific hardware TOTP device (uses your bank card as one of the
> > factors) or TOTP in their apps. I use the TOTP devices, because it's not
> > much of a bother and more secure.
> 
> Does this bank-specific TOTP device use your normal bank
>  credit/debit card (i.e. the one you you make payments or withdraw
>  cash with) or a specific TOTP card. I have one of the latter -
>  though the bank doesn't use it for payments requiring
>  2FA.

  It uses my normal bank card. Mostly a debit card, because most 'local'
(in NL (and EU?)) on-line transactions can be done by a debit card,
which - in our country - is a safer card than a credit card. But also
some credit card transactions work with the bank's TOTP device (our
credit cards are issued by our banks).

> Amex has recently taken to asking for 2 digits of my credit card
>  PIN to authorise some transactions - after years of saying we
>  should never reveal it.

  When I use my credit card in the bank's TOTP device, I need to give
the 4-digit PIN of that card, i.e. the PIN is one factor of 2FA, the
physical card is the other.